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FOP SECRETICOMINTIRELFVEY OOOO O O 
Tor Stinks... 


e We will never be able to de-anonymize all Tor 
users all the time. 

e With manual analysis we can de-anonymize a 
very small fraction of Tor users, however, no 
success de-anonymizing a user in response to a 
TOPI request/on demand. 


oe seceriCoMnTRELEVEY 
REMATION Il u 


e Joint NSA GCHQ counter-Tor workshop 
e Week one at MHS focus on analytics 
e Week two at GCHQ focus on exploitation 


https://wiki.gchq/index.php?title=REMATION 


0 SEORETICOMINTI RELEVEY 
Laundry List « 


e Analytics to de-anonymize users Ħ• Exploitation 


— Circuit reconstruction (21) — QUANTUM attacks (1, 20, 22) 

— Goes inta goes outta/low latency (2) — Existing options (8 + 11) 

— Cookie leakage — Shaping (9 + 16) 

— Dumb users (EPICFAIL) — Web server enabling (10) 

— Node Lifespan (17) — Nodes (14) 

— DNS — Degrade user experience (13 + 18) 
e Technical Analysis/Research e Nodes 

— Hidden services (4, 5, 6, 7) — Baseline our nodes (21) 

— Timing pattern (3) — Tor node flooding 


— Torservers.net/Amazon AWS 


Poe SECRETICOMINTIRELVEY 
Analytics: Circuit Reconstruction ws 
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ANONYMIZER CLOUD 


e Current: access to very few nodes. Success rate negligible 
because all three Tor nodes in the circuit have to be in the set 
of nodes we have access to. 

— Difficult to combine meaningfully with passive SIGINT. 

e Goal: expand number of nodes we have access to 
— GCHQ runs Tor nodes under NEWTONS CRADLE (how many?) 
— Other partners? 


— Partial reconstruction (first hops or last hops)? 


PTO SECRETIICOMINTI/ REL VEY 
Analytics: 
Goes Inta Goes Outta/Low Latency ws 
Find possible alternative accounts for a target: look 
for connections to Tor, from the target’ s 
suspected country, near time of target’ s activity. 
e Current: GCHQ has working version (QUICKANT). R has 


alpha tested NSA’ s version. NSA’ s version produced no 
obvious candidate selectors. 


e Goal: Figure out if QUICKANT works, compare 
methodologies. Gathering data for additional tests of 
NSA’ s version (consistent, random and heavy user) 


Analytics: Cookie Leakage ss 


Use cookies to identify Tor users when they are 
not using Tor 
e Current: preliminary analysis shows that some cookies 
“survive” Tor use. Depends on how target is using Tor 
(Torbutton/Tor Browser Bundle clears out cookies). 
e Goal: test with cookies associated with CT targets 
— Idea: what if we seeded cookies to a target? 


— Investigate Evercookie persistence 


oP SECRETICOMINTIRELVEY 
Analytics: Cookie Leakage ws 


e DoubleclickID seen on Tor and non-Tor IPs 


ce SECRETICOMINTI REL VEY 
Analytics: Dumb Users (EPICFAIL) ss 


GCHQ QFD that looks for Tor users when they 
are not using Tor. 


e Current: GCHQ has working QFD based on 
hard selector (email, web forum, etc) but does 
not include cookies. 

e Goal: NSA investigating own version (GREAT 
EXPECTATIONS) that would include cookies. 
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Ce SEORETICOMINTI RELEVEY 
Analytics: Node Lifespan ss 


How do I| know WHEN a particular IP was a Tor 
node as opposed to IF it was a Tor node? 


e Current: detection done once an hour by NTOC. 
RONIN stores “last seen” and nodes age off 
slowly with no accurate lifespan. 

e Goal: Working with RONIN to add more details 
on node lifespan. 
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oP SEORETICOMINTI RELPVEY 
Analytics: DNS ais 


How does Tor handle DNS requests? Are DNS 
requests going through Tor? Does this depend 
on how the target is using Tor? 


e Current: Still investigating. 


Technical Analysis: Hidden Services 


(TS//S4) 


What do we know about Hidden Services? 


Current: No effort by NSA, some DSD and 
GCHQ work on ONIONBREATH. 
e Goal: 


— Harvest and enumerate .onion URLs 
— Identify similar HS based on referrer fields 
— Distinguish HS from normal Tor clients 


Oe SEORETICOMINTI RELPVEY 
Technical Analysis: Timing Pattern 


(TS//S1) 


Send packets back to the client that are 
detectable by passive accesses to find client 
IPs for Tor users. 


e Current: GCHQ has research paper and 
demonstrated capability in the lab. 


e Goal: Can we expand to other owned nodes? 


Technical Analysis: torservers.net «s, 


SI) 


Investigate the Amazon AWS cloud instances of 
Tor servers. How are IPs allocated and 
reassigned once bandwidth limit is reached? 
Impact on RONIN’ s ability to detect nodes? 


e Current: GCHQ set up Tor nodes on the AWS 
cloud during REMATION II. 


Exploitation: QUANTUM ț ws 


e QUANTUM to degrade/deny/disrupt Tor access? 


e QUANTUMCOOKIE — forces clients to divulge 
stored cookies. 


Figure 4. A diagram of how the QUANTUM Survey / Cookie technique works 


Exploitation: Existing Options us 


Test current CNE techniques (FA and SHORTSHEET) 
against Torbutton and TBB users. 


Current: Torbutton and TBB prevent CNE success. 
Possible success against “vanilla” Tor/Vidalia. 


e Goal: modifications to initial CNE surveys? Ignore 
user-agents from Torbutton or TBB? Improve 
browser fingerprinting? Using javascript instead 
of Flash? 
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POP SECRET/ICOMINTI REL FVEY 
Exploitation: Shaping wns 

Given CNE access to a target computer can we 

shape their traffic to “friendly” exit nodes? 

Route users to a separate “private” Tor network? 


Stain their traffic or user agent? 


Instruct target computer to use a service that 
connects outside Tor and reveal true IP? 


Current: Can stain user agent working on shaping. 


Ce SEORETICOMINTI RELFVEY 
Exploitation: Web Server Enabling 


(TS//S1) 


Given CNE access to web server modify the server 
to enable a “timing/counting” attack similar to 
timing pattern idea. 


e Current: GCHQ has a research paper and 
demonstrated the technique in the lab. 


roe SECRETICOMINTI RELPVEY 
Exploitation: Nodes wm 


Can we exploit nodes? 
Probably not. Legal and technical challenges. 


Poe SEORETICOMINTI RELFVEY 
Exploitation: Degrade Tor experience 


(TS//S1) 


Given CNE access to a web server make it 
painful for Tor users? 


Given CNE access to a network can we deny/ 
degrade/disrupt Tor users’ ? 


FTOPSECRETICOMINT/RELFVEY OOOO O O 
Nodes: Baseline Our Nodes ws 


How many nodes do we have cooperative or 
direct access to? Can we deploy similar code 
to these nodes to aid with circuit 
reconstruction? 

Can we do packet timing attacks using nodes? 

Can we use the nodes to shape traffic flow? 

Can we use the nodes to deny/degrade/disrupt 
comms to certain sites? 
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roe SECRETICOMINTI RELPVEY 
Nodes: Tor Node Flooding ws 


Could we set up a lot of really slow Tor nodes 
(advertised as high bandwidth) to degrade the 
overall stability of the network? 
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FTOPSECRETICOMINT/RELFVEY O OOOO O O 
Tor Stinks... But it Could be Worse 


(S//S1) 


Critical mass of targets use Tor. Scaring them 
away from Tor might be counterproductive. 
We can increase our success rate and provide 
more client IPs for individual Tor users. 


Will never get 100% but we don’ t need to 
provide true IPs for every target every time 
they use Tor. 


